----- Original Message ----- From: "Carlos E. R." To: "SuSE Security List" Sent: Thursday, February 24, 2005 4:13 PM Subject: Re: [suse-security] [SUSE 9.2] SuSEfirewall2 Problem

The Thursday 2005-02-24 at 15:21 +0100, Stefan Schmidt wrote:

...

I'm playing with SuSEfirewall2 on SUSE 9.2 trying to build a screened subnet FW. Here's my test setup: ...

...

FW_DEV_EXT="wlan-bus-pcmcia" FW_DEV_DMZ="eth-id-00:50:04:d2:71:9e"

I still have SuSE 9.1, and I don't know if things have changed that much in 9.2. But in 9.1 that syntax would be incorrect: it expects devices names like "eth0", "ppp0", "ippp1", "tr0", "auto", etc.

Depending on where device is mapped to. If you know your ethernet-id you can check this via ifconfig and look which devices are listed. Above syntax is for kernel 2.6 and it's provided iptables and is generated by yast. Both syntaxes are allowed, but sometimes by using similar or same cards kernel switches devices after reboot. For that you have to set kerneloptions at module loadtime via /etc/modules.conf or the new modules.conf-file provided with kernel 2.6. Philippe

On Thu, Feb 24, 2005 at 09:40:34PM +0100, Rainer Duffner wrote:

BTW (not really security-related, but drove me insane nevertheless): How can I see if I've got a link (and what speed etc.) on a specific nic ? In FreeBSD-land, it's part of the output of ifconfig, but not on my SuSE hosts.

/sbin/ip link show eth0 2: eth0: mtu 1500 qdisc pfifo_fast qlen 1000 link/ether 00:02:b3:1f:2c:a2 brd ff:ff:ff:ff:ff:ff -Kastus

The Thursday 2005-02-24 at 21:24 +0100, Philippe Vogel wrote:

...

...

FW_DEV_EXT="wlan-bus-pcmcia" FW_DEV_DMZ="eth-id-00:50:04:d2:71:9e"

I still have SuSE 9.1, and I don't know if things have changed that much in 9.2. But in 9.1 that syntax would be incorrect: it expects devices names like "eth0", "ppp0", "ippp1", "tr0", "auto", etc.

Depending on where device is mapped to. If you know your ethernet-id you can check this via ifconfig and look which devices are listed. Above syntax is for kernel 2.6 and it's provided iptables and is generated by yast.

Both syntaxes are allowed, but sometimes by using similar or same cards kernel switches devices after reboot. For that you have to set kerneloptions at module loadtime via /etc/modules.conf or the new modules.conf-file provided with kernel 2.6.

Mmm. Interesting. But the "/etc/sysconfig/SuSEfirewall2" file comments don't mention that in SuSE 9.1, and it uses kernel 2.6. What about SuSE 9.2, is this new syntax mentioned on the firewall file? -- Cheers, Carlos Robinson

Carlos E. R. wrote:

The Thursday 2005-02-24 at 15:21 +0100, Stefan Schmidt wrote:

...

I'm playing with SuSEfirewall2 on SUSE 9.2 trying to build a screened subnet FW. Here's my test setup: ...

...

FW_DEV_EXT="wlan-bus-pcmcia" FW_DEV_DMZ="eth-id-00:50:04:d2:71:9e"

I still have SuSE 9.1, and I don't know if things have changed that much in 9.2. But in 9.1 that syntax would be incorrect: it expects devices names like "eth0", "ppp0", "ippp1", "tr0", "auto", etc.

9.1 SuSEfirewall2 also supports configuration names like the above. It uses getcfg-interface to find out the real kernel name. That's needed since the card that becomes "eth0" can change at every boot if you have multiple ethernet cards. cu Ludwig -- (o_ Ludwig Nussel //\ SUSE LINUX Products GmbH, Development V_/_ http://www.suse.de/

Thanks Ludwig for yourk answer :) I was beginning to wonder if I'm too stupid for this stuff ;) Ludwig Nussel wrote:

Stefan Schmidt wrote:

...

[...] FW_DEV_EXT="wlan-bus-pcmcia" FW_DEV_DMZ="eth-id-00:50:04:d2:71:9e" FW_ROUTE="yes" FW_FORWARD="0/0,10.0.0.2,tcp,80 0/0,10.0.0.2,tcp,22"

the rest is more or less standard settings (attached at the end of this email)

Now, when I try to connect to the webserver from the internet I can see the packets with tcpdump at the DMZ server, however, the return packets get blocked by SuSEfirewall2 with the log entry:

Feb 24 13:19:10 linux kernel: SFW2-FWDdmz-DROP-DEFLT IN=eth0 OUT=wlan0 SRC=10.0.0.2 DST=192.168.1.2 LEN=60 TOS=0x08 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=80 DPT=33012 WINDOW=5792 RES=0x00 ACK SYN URGP=0 OPT (020405B40402080A0456274F008ADDF901030302

It's a bug in the 9.2 SuSEfirewall2. An update is already in the queue. What does that mean exactly? Is it in a testing state and will be released soon or is it still being worked on? Any speculations about a release date - I'm kind of in a hurry with this project.

...

---- full SuSEfirewall2 configuration --- $ cat /etc/sysconfig/SuSEfirewall2 | grep -e "FW_" | grep -v "#" FW_QUICKMODE="no" FW_DEV_EXT="wlan-bus-pcmcia" FW_DEV_INT="" FW_DEV_DMZ="eth-id-00:50:04:d2:71:9e" FW_ROUTE="yes" FW_MASQUERADE="no" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="no" FW_SERVICES_*_TCP="" FW_SERVICES_*_UDP=""

^ did you manually edit that in the mail? Yes, that was me. I first had all options in the main text before deciding to put it at the end of the email.

cu Ludwig

Greetings Stefan